Capcom Discloses data breach Affecting Over 11.7 million Capcom ID accounts

Capcom announced in a press release on Oct. 22, 2026 that unauthorized third-party access to its CAPCOM ID service had compromised 11,774,247 email records worldwide, affecting more than 11.7 million accounts.

The breached data included account creation dates and times, last login dates and times, login counts, and the client IP address used at the last login, which Capcom described as system-unique identifiers in a statement. These details are recorded by Capcom’s systems for each account and were tied to the email records exposed in the breach. A separate set of 43 accounts also had dates of birth, gender, country or region, and nicknames exposed, and Capcom did not specify which countries or regions were included among these 43 records. The 43 accounts represent a very small fraction of the total affected accounts.

Capcom confirmed in a statement that credit card information was not part of the compromised data and that no user-chosen passwords were leaked. The company also reported 196 unauthorized password changes on CAPCOM ID accounts and said it has already reset the passwords for those accounts. The company identified the unauthorized changes during its investigation after confirming data leaks on Oct. 20.

Capcom first detected suspicious activity on Oct. 19, 2026, blocked the activity, and confirmed the intrusion the same day, according to the company. An internal response task force was established on Oct. 20, and the incident was reported to the Osaka Prefectural Police and Japan’s Personal Information Protection Commission on Oct. 21. The company said affected users will be contacted as its investigation continues.

Capcom said it completed emergency response measures, and identified and addressed the attack method involved in the incident. “Based on the findings of the investigation, it will implement measures to prevent recurrence and further strengthen its information security framework,” Capcom said. The company also said it will determine the cause and share any newly confirmed facts through its official website.

Inven Global notes that the announcement left the original start date of the intrusion undisclosed.

Capcom warned that exposed email addresses could be used for phishing emails impersonating Capcom or related organizations and advised users not to click links or open attached files in suspicious messages. “If you receive any suspicious email or message, please exercise caution and refrain from accessing any URLs contained therein or opening any attached files,” Capcom said.

Capcom is contacting affected users individually in sequence and opened a dedicated toll-free phone hotline in Japan for the incident, according to the company. Users in Asia and Oceania outside Japan may direct inquiries to Capcom Asia customer support at info-asia@capcom.com.

Capcom said in a statement that its video games and online services remain accessible and that registered email addresses can continue to be used without hindrance. The company does not expect its games to be affected, and titles such as Street Fighter 6 and Pragmata are still playable.

CAPCOM ID is a unified account used across Capcom web services and select online games, providing access to titles including Resident Evil Requiem and Onimusha: Way of the Sword, according to the company. The service provides access to various online features across Capcom’s gaming ecosystem.

As of Oct. 22, 2026, Capcom’s investigation into the full impact of the incident remains underway. The company confirmed that customer information associated with Capcom ID was accessed by a third party on Oct. 19.

IGN reported that Capcom did not provide details on how the intrusion occurred, despite having addressed the attack method.

Capcom disclosed the total number of leaked email addresses and system-unique identifiers only as a worldwide figure, without a country or region breakdown, in its announcement. The impact on users in Korea cannot be determined from the announcement.